# Get member picture

`GET /api/members/{memberId}/base64-member-picture`

- **Success:** `200 OK`
- **Products:** Operator (`FOH`), Consumer (`CONSUMER`), Integrations (`INTEGRATIONS`) (any one of these products, not all)
- **Features:** Online Bookings (`ONLINEBOOK`), Online Joining (`ONLINEJOIN`), TRP Integration (`TRP`), Front of House Generic Access (`FOHGENERIC`) (any one of these features, not all)

HTML version: [Get member picture](https://support.gladstonesoftware.cloud/reference/members/get-member-picture)

## Overview

Retrieves a member's profile photograph — the one staff see at reception to confirm who is presenting a card — together with the member's photo upload history and the upload limits that apply to them. Use it to show the current photo, and to tell the member whether they can change it now and, if not, when they can.

A member with no photograph returns **`200` with `picture` set to `null`**, not `404`; the upload history and limits are still returned. Most members typically have no picture, so treat a null `picture` as an ordinary outcome. A `404` now means the member itself does not exist.

Two limits govern a new photo, and both are reported in the response:

- **Change frequency.** After a successful upload the member must wait `uploadFrequency` days before uploading again. They can upload now if `lastSuccessfulPhotoUploadUtc` is `null`, or if that time plus `uploadFrequency` days is in the past; otherwise that same sum is the earliest time they can. A call to [Update member picture](update-member-picture.md) made sooner is refused with `409`.
- **Photo-check attempts.** Before a photo is stored it can be put through Gladstone's photo checks (face detection and the other content checks). Each completed check — accepted or rejected — counts as one attempt, and a member may make at most `maxRetries` attempts in a 24-hour window. Checks that fail for a server-side reason are not counted. A successful upload resets the count to `0`.

The attempt count is not cleared when its window ends; it is reset the next time the member makes an attempt. Work out whether it is still current yourself: if `pictureValidationAttemptWindowStartUtc` is `null` or more than 24 hours ago, treat the count as `0`. If it is within the last 24 hours and `pictureValidationAttemptCount` has reached `maxRetries`, no further attempt is accepted until 24 hours after the window start. A `maxRetries` of `0` means attempts are unlimited.

The image comes back raw: no data URI prefix, no content type and no dimensions. You are told nothing about the format, so if you need to render it you will have to sniff the bytes or assume what your operator uploads.

This endpoint is single-member only — a linked member's picture cannot be read with a primary member's token.

## Endpoint

`GET {base_url}/api/members/{memberId}/base64-member-picture`

`{base_url}` is the environment URL issued to your integration. See [Authenticating with Gladstone APIs](../../guides/authenticating-with-gladstone-apis.md).

## Path parameters

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `memberId` | integer (int32) | Yes | The member whose picture and upload status you want. Must be greater than `0`; `0` and `-999` are rejected with `400`. With a member-scoped token this must be the token's own member — linked members are not accepted. |

## Sample request

```bash title="cURL"
curl -X GET '{base_url}/api/members/{memberId}/base64-member-picture' \
  -H 'Authorization: Bearer {accessToken}' \
  -H 'X-Use-SSO: true'
```

## Response fields

All date-times are UTC. Treat them as UTC whether or not the value carries a `Z` suffix.

| Field | Type | Description |
|-------|------|-------------|
| `picture` | string | The image bytes, base64-encoded, or `null` when the member has no picture. Standard base64 with no `data:image/...;base64,` prefix — add one yourself if you are putting it in an `img` tag. The image format is whatever was uploaded and is not reported anywhere in the response. |
| `lastSuccessfulPhotoUploadUtc` | string (date-time) | When the member's picture was last stored successfully, or `null` if no upload has been recorded for them. Add `uploadFrequency` days to find the earliest time the member can upload again. |
| `pictureValidationAttemptCount` | integer (int32) | Photo-check attempts recorded in the window that started at `pictureValidationAttemptWindowStartUtc`. Counts accepted and rejected checks alike; checks that failed for a server-side reason are not counted. `0` when the member has no upload history, and reset to `0` by a successful upload. Not cleared when the window ends — see the Overview for how to tell whether it is current. |
| `pictureValidationAttemptWindowStartUtc` | string (date-time) | Start of the 24-hour window that `pictureValidationAttemptCount` applies to, or `null` when the member has no upload history. A window more than 24 hours old has expired, and the count with it. |
| `uploadFrequency` | integer (int32) | Minimum number of days the member must wait between successful uploads, as configured for your organisation. Defaults to `180` when not configured. `0` means there is no waiting period. |
| `maxRetries` | integer (int32) | Maximum number of photo-check attempts the member may make in a 24-hour window. Defaults to `5` when not configured. `0` means attempts are unlimited. |

## Sample response

```json title="200 OK"
{
  "picture": "iVBORw0KGgoAAAANSUhEUgAA...",
  "lastSuccessfulPhotoUploadUtc": "2026-04-14T09:31:07",
  "pictureValidationAttemptCount": 2,
  "pictureValidationAttemptWindowStartUtc": "2026-10-12T08:02:44",
  "uploadFrequency": 180,
  "maxRetries": 5
}
```

```json title="200 OK — member with no picture or upload history"
{
  "picture": null,
  "lastSuccessfulPhotoUploadUtc": null,
  "pictureValidationAttemptCount": 0,
  "pictureValidationAttemptWindowStartUtc": null,
  "uploadFrequency": 180,
  "maxRetries": 5
}
```

## Errors

| Status | Meaning | When |
|--------|---------|------|
| `400` | Bad request | `memberId` is `0` or negative. The body is `{memberId} is an invalid member ID`. |
| `403` | Forbidden | The token belongs to a different member. Linked members are not accepted here. The body is `The given member ID of {memberId} does not belong to the logged in member`. |
| `404` | Not found | No member exists with that id. The body is `Member with id '{memberId}' does not exist`. A member who exists but has no picture is not an error: see `picture`. |
| `500` | Internal server error | An unexpected server-side failure while reading the picture or upload history. No detail is returned in the body. |